Hacking Sadly a clone card owner, just a single question.

[irvingsp]

Hello people,
just before everyone starts blaming me and to every clone card owner, Is it possible for R4i to update their "firmware" to the newest firmare 2.0? I saw something about a FPGA update, not sure how that works, but from I saw its not possible to make it work in a clone card, is this real?

Please again, just answer the question, I already know that I should have bought the GW card from the beginning, but its hard to get one in Mexico, I had to buy the fuc#"$ clone card. So please people, be kind, and only answer the question. Once that is clear, moderators can close this thread to prevent stupid posts.

Thanks in advance.

 

[kyogre123]

Please again, just answer the question

OK: No.

 

[Technicmaster0]

OK: No.

We don't know yet.

 

[kyogre123]

We don't know yet.

Then the answer is no until proven otherwise.

 

[Technicmaster0]

Then the answer is no until proven otherwise.

GW will not release 2.0 until proven otherwise.

 

[kyogre123]

GW will not release 2.0 until proven otherwise.

What does that have to do with this topic?

 

[Technicmaster0]

What does that have to do with this topic?

It's just an example that you shouldn't denie that without giving R4 a bit time.

 

[kyogre123]

It's just an example that you shouldn't denie that without giving R4 a bit time.

I guess this is what the OP wanted to avoid, discussing pointless guessings.

By the way, Gateway just released some news, they said they will release Omega (in their site) in 48 hours.

 

[lenselijer]

The clones use the same actel chip as gateway, so i still have some hope.
If they cannot do it they will just release a new version, just like with the normal r4i cards.
No problem because 2x r4i gold deluxe is still cheaper than 1 gateway

 

[Technicmaster0]

I guess this is what the OP wanted to avoid, discussing pointless guessings.

By the way, Gateway just released some news, they said they will release Omega (in their site) in 48 hours.

It doesn't really make sense for them to keep it private anyways. (But that has nothing to do with the topic either)

 

[kyogre123]

It doesn't really make sense for them to keep it private anyways. (But that has nothing to do with the topic either)

Yet you were the one bringing that point in.

Edit: At least thanks to the awesome mathieulh, we know for a fact that the new launcher is more obfuscated, aww, too much work for the lazy R4i.

 

[Qtis]

Seriously guys. If someone has a R4i or another one of the clone cards, there is no reason to be rude or not answer the question. There should be no reason or need for someone to add a comment in their OP that they apologise for buying something.

The answer to the question? Maybe. It's not a definite no, but it's not a definite yes either. If they rely solely on the Gateway launcher, then it may at least take a while.

 

[mathieulh]

There is no current technical way for the existing clone cards to run 2.0 Omega, the ASIC would need to be updated and it can't (short of disassembling the cards and connecting the right pins to an external programmer).

The only current competiting card that can update it's ASIC is the MT Card.

 

[b00100100]

There is no current technical way for the existing clone cards to run 2.0 Omega, the ASIC would need to be updated and it can't (short of disassembling the cards and connecting the right pins to an external programmer).

The only current competiting card that can update it's ASIC is the MT Card.

You are misinformed. For starters ASIC's are not reprogrammable, and secondly, none of these cards have ASIC's implemented. They use FPGA's.

I find it hard to believe that a clone card also wouldnt hook up the necessary JTAG signals to also do reprogramming. If GW has the necessary hooks, it's 99.9% likely that a clone does as well. They might have a different programing method though, and the best bet for people in this situation is to just wait for their maker to make an announcement. Since we know GW puts bricking code in the past stuff, I wouldnt want to be blindly trying to program that with my own hardware.

 

[mathieulh]

You are misinformed. For starters ASIC's are not reprogrammable, and secondly, none of these cards have ASIC's implemented. They use FPGA's.

I find it hard to believe that a clone card also wouldnt hook up the necessary JTAG signals to also do reprogramming. If GW has the necessary hooks, it's 99.9% likely that a clone does as well. They might have a different programing method though, and the best bet for people in this situation is to just wait for their maker to make an announcement. Since we know GW puts bricking code in the past stuff, I wouldnt want to be blindly trying to program that with my own hardware.

http://en.wikipedia.org/wiki/Application-specific_integrated_circuit
So you have an FPGA performing the very same function as an ASIC, great deal, and yes in this instance the only difference is the reprogrammable gates array.

As to the clones, their JTAG pins aren't exposed, if you read their specific ACTEL A3P250 datasheet, you will see that these FPGA can ONLY be reprogrammed through JTAG (woops, something tells me you haven't red that...)

In fact on the Gateway, the ACTEL JTAG pins are exposed and used durring the updating process, you can't just grab a clone card, put it in place of the real one and start updating as you suggest, the pinouts are different to begin with, not to mention even if you do reprogram the FPGA ROM with the update from Omega, using "your own hardware", that update is encrypted and gets decrypted in place on the FPGA, obviously the clone cards' FPGA do not have the required key to decrypt it so it'll never work.

What could be done is to copy the FPGA's logic (studying the I/Os and such) and update their own so it'd work on a copy of the Omega firmware, unfortunately, you cannot update the FPGA as-is, so it's a moot point, that's why they came up with MT in the first place (MT is produced by the same company/manufacturer).

 

[gamefan5]

http://en.wikipedia.org/wiki/Application-specific_integrated_circuit
So you have an FPGA performing the very same function as an ASIC, great deal, and yes in this instance the only difference is the reprogrammable gates array.

As to the clones, their JTAG pins aren't exposed, if you read their specific ACTEL A3P250 datasheet, you will see that these FPGA can ONLY be reprogrammed through JTAG (woops, something tells me you haven't red that...)

In fact on the Gateway, the ACTEL JTAG pins are exposed and used durring the updating process, you can't just grab a clone card, put it in place of the real one and start updating as you suggest, the pinouts are different to begin with, not to mention even if you do reprogram the FPGA ROM with the update from Omega, using "your own hardware", that update is encrypted and gets decrypted in place on the FPGA, obviously the clone cards' FPGA do not have the required key to decrypt it so it'll never work.

What could be done is to copy the FPGA's logic (studying the I/Os and such) and update their own so it'd work on a copy of the Omega firmware, unfortunately, you cannot update the FPGA as-is, so it's a moot point, that's why they came up with MT in the first place (MT is produced by the same company/manufacturer).

Dat post needs to be stickied.

 

[b00100100]

http://en.wikipedia.org/wiki/Application-specific_integrated_circuit
So you have an FPGA performing the very same function as an ASIC, great deal, and yes in this instance the only difference is the reprogrammable gates array.

As to the clones, their JTAG pins aren't exposed, if you read their specific ACTEL A3P250 datasheet, you will see that these FPGA can ONLY be reprogrammed through JTAG (woops, something tells me you haven't red that...)

In fact on the Gateway, the ACTEL JTAG pins are exposed and used durring the updating process, you can't just grab a clone card, put it in place of the real one and start updating as you suggest, the pinouts are different to begin with, not to mention even if you do reprogram the FPGA ROM with the update from Omega, using "your own hardware", that update is encrypted and gets decrypted in place on the FPGA, obviously the clone cards' FPGA do not have the required key to decrypt it so it'll never work.

What could be done is to copy the FPGA's logic (studying the I/Os and such) and update their own so it'd work on a copy of the Omega firmware, unfortunately, you cannot update the FPGA as-is, so it's a moot point, that's why they came up with MT in the first place (MT is produced by the same company/manufacturer).

Again, You are misinformed. I'm a FPGA/ASIC designer, graduated with my Masters in EE in 2000, and have been heavily working with Microsemi FPGA's (which were previously named Actel) for the last 6 years.

You are correct that FPGA's and ASIC's are interchangeable technologies, however to tape out an ASIC a fab will charge you about 1+ million dollars depending on the technology size and the density of your ASIC. Although you can use either technology to perform custom logic tasks, the internals of the two technologies are very different. In the Microsemi (aka Actel) case, they are very very different because they use flash based FPGA's. Xilinx and Altera are a little close to the ASIC process but not really that close.

Yes, the Microsemi JTAG pins on the clones are exposed and looking at the Microsemi A3P250 datasheet isn't going to tell you if they have board traces to the JTAG pins. The bottom line is the FPGA's in these devices are quadpack and have all their pins exposed. You know how the cloners programed their FPGA? They used JTAG. So yes the JTAG signals on the part are exposed, but there is no confirmation that I've seen that they hooked those pins up in the same way that GW did.

Do you want to know how you can determine if the clone cards have the same traces? You open up the card, look at the data sheet, and then take an ohm meter and ohm out the JTAG signals (TDI, TDO, TMS, TCK). By ohm out the signals I mean you check to see where they are hooked up to inside of the circuit card. Both GW and the cloners are probably hooked up to the quadpack microcontroller on the other side. And both as probably using the same microcontroller. I would easily do this in 2 minutes, but I dont have a clone card, nor do I really care about clone cards.

 

[b00100100]

Dat post needs to be stickied.

Except the dude is a kid and has no idea what he is talking about. The only thing I agree with him on is that anyone with a R4 card that wants to upgrade to 2.0 with the GW firmware is likely going to ruin their card. People with R4 cards should wait until their people tell them to upgrade....

 

[mathieulh]

Again, You are misinformed. I'm a FPGA/ASIC designer, graduated with my Masters in EE in 2000, and have been heavily working with Microsemi FPGA's (which were previously named Actel) for the last 6 years.

You are correct that FPGA's and ASIC's are interchangeable technologies, however to tape out an ASIC a fab will charge you about 1+ million dollars depending on the technology size and the density of your ASIC. Although you can use either technology to perform custom logic tasks, the internals of the two technologies are very different. In the Microsemi (aka Actel) case, they are very very different because they use flash based FPGA's. Xilinx and Altera are a little close to the ASIC process but not really that close.

Yes, the Microsemi JTAG pins on the clones are exposed and looking at the Microsemi A3P250 datasheet isn't going to tell you if they have board traces to the JTAG pins. The bottom line is the FPGA's in these devices are quadpack and have all their pins exposed. You know how the cloners programed their FPGA? They used JTAG. So yes the JTAG signals on the part are exposed, but there is no confirmation that I've seen that they hooked those pins up in the same way that GW did.

Do you want to know how you can determine if the clone cards have the same traces? You open up the card, look at the data sheet, and then take an ohm meter and ohm out the JTAG signals (TDI, TDO, TMS, TCK). By ohm out the signals I mean you check to see where they are hooked up to inside of the circuit card. Both GW and the cloners are probably hooked up to the quadpack microcontroller on the other side. And both as probably using the same microcontroller. I would easily do this in 2 minutes, but I dont have a clone card, nor do I really care about clone cards.

By exposed, I meant to the 3DS SLOT1 ports pin, obviously not directly on the PCB, do you expect costumers to remove the cards casings ? I certainly do not.
All I can see is that you do like to play with words. If by exposed you mean on the PCB, then yes, if you mean to the 3DS (or to the consumer), then no.

In fact the JTAG pins on the clone cards trace directly to the back of the pins that connect to SLOT1 (as in, the back of the card) so they are blocked by the cards' shell after assembly.
And yes, obviously it is possible to program the FPGA using JTAG if you have direct access to the PCB before the shell covers it up, like precisely when it's done at their factory

Have you put 2+2 together yet?

Feel free to trace everything on your own, not that many people haven't done that already.

P.S. Don't get me wrong, you do seem knowledgeable in this field, however I couldn't care less what master you graduated in.

I have seen plenty of people with EE degrees that don't know a thing about Electronic Engineering.
As far as you're concerned, that doesn't seem to be the case, that doesn't mean I give any credits to such degrees whatsoever.

Oh! And the fact that people don't know what I graduated in is simply because I don't spend my time on forums boasting about it. (just my personal opinion on this)

Now we could play a game of words to try and see who's the best at whatever (which I clearly don't care about) or we can spend some of our respective intellect to have constructive talks.

(Oh! and you really need to read datasheets before posting about a component, especially when those are public, but that's just my own personal opinion)

 

[Commoner]

You are misinformed. For starters ASIC's are not reprogrammable, and secondly, none of these cards have ASIC's implemented. They use FPGA's.

I find it hard to believe that a clone card also wouldnt hook up the necessary JTAG signals to also do reprogramming. If GW has the necessary hooks, it's 99.9% likely that a clone does as well. They might have a different programing method though, and the best bet for people in this situation is to just wait for their maker to make an announcement. Since we know GW puts bricking code in the past stuff, I wouldnt want to be blindly trying to program that with my own hardware.

This topic was actually discussed thoroughly shortly after the first clone carts came out and Gateway first announced that the Gateway 2.0 Update would require people to update their FPGA.

A couple of community members traced where the FPGA's JTAG pins lead to on the corresponding PCBs for both the Gateway and the Clone Carts and even posted pictures to show exactly how one could trace where these pins terminated.

On the Gateway, they lead to contacts placed facing towards the front of the cart. These were clearly meant to connect to the contacts on the cart slot of the 3DS when the Gateway Red Cart was inserted into the console.

In contrast, clone carts had these JTAG pins lead to contacts facing the back of the cart. These would not come into contact with anything when the clone cart is inserted into a 3DS. The contacts could, however, could possibly have been designed to be accessible through a separate, unknown specialized device.

Since access to the JTAG pins is necessary to reprogram the FPGA, it was the general consensus that it would be impossible to apply an FPGA update on the clone carts through a regular 3DS. There was some heated debate on whether the Gateway FPGA could be updated through a 3DS or not, since the console did not seem to have been built for doing that kind of thing. While most people generally believed it was possible but would require some really creative method of updating the FPGA, a good number outright declared it was completely impossible to do this. There were various technical reasons sited which I will not go into here for the sake of brevity.

With the release of the Gateway 2.0 Omega Private Beta, it appears that they did in fact find a way to use the 3DS to update the FPGA.

The lack of any physical connection between the JTAG Pins on the FPGAs of the Clone Carts to the 3DS, seems to completely rule out any sort if FPGA update through the 3DS. It does not mean, however that there will be no way to update the FPGAs of these clone carts at all. Even back then there were a few who were predicting that the R4i Gold Deluxe Team would probably begin selling an update kit which you could use to update your clone carts either through usb interface, or perhaps through an adapter which would provide leads that hook put the JTAG pins to the cart slot contacts in the 3DS. Some even speculated that this may have been their plan all along in order to earn supplementary income. After all, why else would they bother terminating the JTAG pins at the back of the cart if not for this reason?

One should take note, however, that these discussions were held during a period in which both Gateway and the Clone Carts were actively releasing updates and news to the community.

The fact that R4i Gold Deluxe and the other clone carts never released an update to address the Bricking Issue which heavily affected their Flash Carts, and their long silence shortly after the Bricking Fiasco began, seems to indicate that any further updates for the clone carts is quite unlikely.

In this kind of environment I would be more than a little surprised if the Clone Carts came out with a copy of the Gateway 2.0 Omega Private Beta Update, even if did require the purchase of a new Adapter / Update Kit.